Vulnerabilities > CVE-2016-2125 - Improper Input Validation vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
ADJACENT_NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
low complexity
samba
redhat
CWE-20
nessus

Summary

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

Vulnerable Configurations

Part Description Count
Application
Samba
236
Application
Redhat
1
OS
Redhat
14

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3740.NASL
    descriptionSeveral vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2016-2119 Stefan Metzmacher discovered that client-side SMB2/3 required signing can be downgraded, allowing a man-in-the-middle attacker to impersonate a server being connected to by Samba, and return malicious results. - CVE-2016-2123 Trend Micro
    last seen2020-06-01
    modified2020-06-02
    plugin id95936
    published2016-12-20
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95936
    titleDebian DSA-3740-1 : samba - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3740. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95936);
      script_version("3.9");
      script_cvs_date("Date: 2019/01/30  9:29:41");
    
      script_cve_id("CVE-2016-2119", "CVE-2016-2123", "CVE-2016-2125", "CVE-2016-2126");
      script_xref(name:"DSA", value:"3740");
    
      script_name(english:"Debian DSA-3740-1 : samba - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in Samba, a SMB/CIFS
    file, print, and login server for Unix. The Common Vulnerabilities and
    Exposures project identifies the following issues :
    
      - CVE-2016-2119
        Stefan Metzmacher discovered that client-side SMB2/3
        required signing can be downgraded, allowing a
        man-in-the-middle attacker to impersonate a server being
        connected to by Samba, and return malicious results.
    
      - CVE-2016-2123
        Trend Micro's Zero Day Initiative and Frederic Besler
        discovered that the routine ndr_pull_dnsp_name, used to
        parse data from the Samba Active Directory ldb database,
        contains an integer overflow flaw, leading to an
        attacker-controlled memory overwrite. An authenticated
        user can take advantage of this flaw for remote
        privilege escalation.
    
      - CVE-2016-2125
        Simo Sorce of Red Hat discovered that the Samba client
        code always requests a forwardable ticket when using
        Kerberos authentication. A target server, which must be
        in the current or trusted domain/realm, is given a valid
        general purpose Kerberos 'Ticket Granting Ticket' (TGT),
        which can be used to fully impersonate the authenticated
        user or service.
    
      - CVE-2016-2126
        Volker Lendecke discovered several flaws in the Kerberos
        PAC validation. A remote, authenticated, attacker can
        cause the winbindd process to crash using a legitimate
        Kerberos ticket due to incorrect handling of the PAC
        checksum. A local service with access to the winbindd
        privileged pipe can cause winbindd to cache elevated
        access permissions."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=830195"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-2119"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-2123"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-2125"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2016-2126"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/samba"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2016/dsa-3740"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the samba packages.
    
    For the stable distribution (jessie), these problems have been fixed
    in version 2:4.2.14+dfsg-0+deb8u2. In addition, this update contains
    several changes originally targeted for the upcoming jessie point
    release."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:samba");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/12/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/12/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"libnss-winbind", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libpam-smbpass", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libpam-winbind", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libparse-pidl-perl", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libsmbclient", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libsmbclient-dev", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libsmbsharemodes-dev", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libsmbsharemodes0", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libwbclient-dev", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"libwbclient0", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"python-samba", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"registry-tools", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-common", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-common-bin", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-dbg", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-dev", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-doc", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-dsdb-modules", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-libs", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-testsuite", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"samba-vfs-modules", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"smbclient", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    if (deb_check(release:"8.0", prefix:"winbind", reference:"2:4.2.14+dfsg-0+deb8u2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-1265.NASL
    descriptionAn update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) * A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619) Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.
    last seen2020-06-01
    modified2020-06-02
    plugin id100329
    published2017-05-23
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100329
    titleCentOS 7 : samba (CESA-2017:1265)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2017:1265 and 
    # CentOS Errata and Security Advisory 2017:1265 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100329);
      script_version("3.13");
      script_cvs_date("Date: 2019/12/31");
    
      script_cve_id("CVE-2016-2125", "CVE-2016-2126", "CVE-2017-2619");
      script_xref(name:"RHSA", value:"2017:1265");
    
      script_name(english:"CentOS 7 : samba (CESA-2017:1265)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for samba is now available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Samba is an open source implementation of the Server Message Block
    (SMB) protocol and the related Common Internet File System (CIFS)
    protocol, which allow PC-compatible machines to share files, printers,
    and various information.
    
    Security Fix(es) :
    
    * It was found that Samba always requested forwardable tickets when
    using Kerberos authentication. A service to which Samba authenticated
    using Kerberos could subsequently use the ticket to impersonate Samba
    to other services or domain users. (CVE-2016-2125)
    
    * A flaw was found in the way Samba handled PAC (Privilege Attribute
    Certificate) checksums. A remote, authenticated attacker could use
    this flaw to crash the winbindd process. (CVE-2016-2126)
    
    * A race condition was found in samba server. A malicious samba client
    could use this flaw to access files and directories, in areas of the
    server file system not exported under the share definitions.
    (CVE-2017-2619)
    
    Red Hat would like to thank the Samba project for reporting
    CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the
    original reporter of CVE-2017-2619."
      );
      # https://lists.centos.org/pipermail/centos-announce/2017-May/022412.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?a0389580"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected samba packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2619");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ctdb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:ctdb-tests");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsmbclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libsmbclient-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libwbclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libwbclient-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-client-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-common-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-common-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-dc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-dc-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-krb5-printing");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-pidl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-test-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-vfs-glusterfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-winbind");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-winbind-clients");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-winbind-krb5-locator");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:samba-winbind-modules");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/23");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"ctdb-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"ctdb-tests-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsmbclient-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libsmbclient-devel-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libwbclient-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"libwbclient-devel-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-client-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-client-libs-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-common-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-common-libs-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-common-tools-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-dc-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-dc-libs-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-devel-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-krb5-printing-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-libs-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-pidl-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-python-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-test-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-test-libs-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-vfs-glusterfs-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-winbind-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-winbind-clients-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-winbind-krb5-locator-4.4.4-13.el7_3")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"samba-winbind-modules-4.4.4-13.el7_3")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc");
    }
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1104.NASL
    descriptionAccording to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) - A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619) - A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-06-09
    plugin id100697
    published2017-06-09
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100697
    titleEulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1104)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(100697);
      script_version("3.15");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");
    
      script_cve_id(
        "CVE-2016-2125",
        "CVE-2016-2126",
        "CVE-2017-2619",
        "CVE-2017-7494"
      );
    
      script_name(english:"EulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1104)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing multiple security updates.");
      script_set_attribute(attribute:"description", value:
    "According to the versions of the samba packages installed, the
    EulerOS installation on the remote host is affected by the following
    vulnerabilities :
    
      - It was found that Samba always requested forwardable
        tickets when using Kerberos authentication. A service
        to which Samba authenticated using Kerberos could
        subsequently use the ticket to impersonate Samba to
        other services or domain users. (CVE-2016-2125)
    
      - A flaw was found in the way Samba handled PAC
        (Privilege Attribute Certificate) checksums. A remote,
        authenticated attacker could use this flaw to crash the
        winbindd process. (CVE-2016-2126)
    
      - A race condition was found in samba server. A malicious
        samba client could use this flaw to access files and
        directories, in areas of the server file system not
        exported under the share definitions. (CVE-2017-2619)
    
      - A remote code execution flaw was found in Samba. A
        malicious authenticated samba client, having write
        access to the samba share, could use this flaw to
        execute arbitrary code as root. (CVE-2017-7494)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1104
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4fe4f154");
      script_set_attribute(attribute:"solution", value:
    "Update the affected samba packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Samba is_known_pipename() Arbitrary Module Load');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/05/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/06/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsmbclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libwbclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-client-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind-clients");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind-modules");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(1)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP1");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP1", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["libsmbclient-4.2.10-7.h4",
            "libwbclient-4.2.10-7.h4",
            "samba-4.2.10-7.h4",
            "samba-client-4.2.10-7.h4",
            "samba-client-libs-4.2.10-7.h4",
            "samba-common-4.2.10-7.h4",
            "samba-common-libs-4.2.10-7.h4",
            "samba-common-tools-4.2.10-7.h4",
            "samba-libs-4.2.10-7.h4",
            "samba-python-4.2.10-7.h4",
            "samba-winbind-4.2.10-7.h4",
            "samba-winbind-clients-4.2.10-7.h4",
            "samba-winbind-modules-4.2.10-7.h4"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"1", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "samba");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0495.NASL
    descriptionAn update for samba is now available for Red Hat Gluster Storage 3.2 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.4.6). (BZ#1382287) Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Enhancement(s) : * gluster vfs plugin now supports more than one volfile servers. Samba tries to connect to the next server on the list if one of the gluster server is not reachable. (BZ#1330081)
    last seen2020-06-01
    modified2020-06-02
    plugin id97931
    published2017-03-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97931
    titleRHEL 7 : Gluster Storage (RHSA-2017:0495)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2017:0495. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(97931);
      script_version("3.15");
      script_cvs_date("Date: 2019/10/24 15:35:42");
    
      script_cve_id("CVE-2016-2125", "CVE-2016-2126");
      script_xref(name:"RHSA", value:"2017:0495");
    
      script_name(english:"RHEL 7 : Gluster Storage (RHSA-2017:0495)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for samba is now available for Red Hat Gluster Storage 3.2
    for RHEL 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    Samba is an open source implementation of the Server Message Block
    (SMB) protocol and the related Common Internet File System (CIFS)
    protocol, which allow PC-compatible machines to share files, printers,
    and various information.
    
    The following packages have been upgraded to a later upstream version:
    samba (4.4.6). (BZ#1382287)
    
    Security Fix(es) :
    
    * It was found that Samba always requested forwardable tickets when
    using Kerberos authentication. A service to which Samba authenticated
    using Kerberos could subsequently use the ticket to impersonate Samba
    to other services or domain users. (CVE-2016-2125)
    
    * A flaw was found in the way Samba handled PAC (Privilege Attribute
    Certificate) checksums. A remote, authenticated attacker could use
    this flaw to crash the winbindd process. (CVE-2016-2126)
    
    Enhancement(s) :
    
    * gluster vfs plugin now supports more than one volfile servers. Samba
    tries to connect to the next server on the list if one of the gluster
    server is not reachable. (BZ#1330081)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2017:0495"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-2125"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2016-2126"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ctdb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:ctdb-tests");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsmbclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libsmbclient-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libwbclient");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libwbclient-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-client");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-client-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-common-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-common-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-dc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-dc-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-krb5-printing");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-pidl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-test-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-vfs-glusterfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind-clients");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind-krb5-locator");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:samba-winbind-modules");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/03/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/03/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2017:0495";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
    
      if (! (rpm_exists(release:"RHEL7", rpm:"glusterfs-server"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "Gluster Storage");
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ctdb-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"ctdb-tests-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libsmbclient-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libsmbclient-devel-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libwbclient-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"libwbclient-devel-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-client-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-client-libs-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"samba-common-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-common-libs-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-common-tools-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-dc-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-dc-libs-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-debuginfo-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-devel-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-krb5-printing-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-libs-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", reference:"samba-pidl-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-python-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-test-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-test-libs-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-vfs-glusterfs-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-winbind-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-winbind-clients-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-winbind-krb5-locator-4.4.6-4.el7")) flag++;
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"samba-winbind-modules-4.4.6-4.el7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc");
      }
    }
    
  • NASL familyMisc.
    NASL idPULSE_CONNECT_SECURE-SA-43730.NASL
    descriptionAccording to its self-reported version, the version of Pulse Connect Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information.
    last seen2020-06-01
    modified2020-06-02
    plugin id109919
    published2018-05-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109919
    titlePulse Connect Secure Multiple Vulnerabilities (SA43730)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0744.NASL
    descriptionAn update for samba4 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id97884
    published2017-03-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97884
    titleRHEL 6 : samba4 (RHSA-2017:0744)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0662.NASL
    descriptionAn update for samba is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id97880
    published2017-03-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97880
    titleRHEL 6 : samba (RHSA-2017:0662)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3300-1.NASL
    descriptionThis update for samba provides the following fixes: Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id96262
    published2017-01-03
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96262
    titleSUSE SLES11 Security Update : samba (SUSE-SU-2016:3300-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0662.NASL
    descriptionAn update for samba is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id97957
    published2017-03-27
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97957
    titleCentOS 6 : samba (CESA-2017:0662)
  • NASL familyMisc.
    NASL idPULSE_POLICY_SECURE-SA-43730.NASL
    descriptionAccording to its self-reported version, the version of Pulse Policy Secure running on the remote host is affected by multiple vulnerabilities. Refer to the vendor advisory for additional information.
    last seen2020-06-01
    modified2020-06-02
    plugin id109920
    published2018-05-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109920
    titlePulse Policy Secure Multiple Vulnerabilities (SA43730)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0096_SAMBA.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has samba packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127320
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127320
    titleNewStart CGSL MAIN 4.05 : samba Multiple Vulnerabilities (NS-SA-2019-0096)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-12.NASL
    descriptionThis update for samba fixes the following issues : Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-05
    modified2017-01-05
    plugin id96294
    published2017-01-05
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96294
    titleopenSUSE Security Update : samba (openSUSE-2017-12)
  • NASL familyMisc.
    NASL idSAMBA_4_5_3.NASL
    descriptionThe version of Samba running on the remote host is 4.3.x prior to 4.3.13, 4.4.x prior to 4.4.8, or 4.5.x prior to 4.5.3. It is, therefore, affected by multiple vulnerabilities : - An overflow condition exists in the ndr_pull_dnsp_name() function in ndr_dnsp.c that is triggered when handling
    last seen2020-06-01
    modified2020-06-02
    plugin id96142
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96142
    titleSamba 4.3.x < 4.3.13 / 4.4.x < 4.4.8 / 4.5.x < 4.5.3 Multiple Vulnerabilities
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-1265.NASL
    descriptionAn update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) * A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619) Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619. Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id101469
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101469
    titleVirtuozzo 7 : ctdb / ctdb-tests / libsmbclient / etc (VZLSA-2017-1265)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170522_SAMBA_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) - A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619)
    last seen2020-03-18
    modified2017-05-23
    plugin id100350
    published2017-05-23
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100350
    titleScientific Linux Security Update : samba on SL7.x x86_64 (20170522)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3298-1.NASL
    descriptionThis update for samba provides the following fixes: Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id96260
    published2017-01-03
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96260
    titleSUSE SLES11 Security Update : samba (SUSE-SU-2016:3298-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0494.NASL
    descriptionAn update for samba is now available for Red Hat Gluster Storage 3.2 for RHEL 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.4.6). (BZ#1382291) Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Enhancement(s) : * The gluster vfs plugin now supports more than one volfile server. Samba tries to connect to the next server on the list if one of the gluster servers is not reachable. (BZ#1330081) * This update provides stability and improvements in error handling and code maintainability in the shadow copy module. (BZ#1385663)
    last seen2020-06-01
    modified2020-06-02
    plugin id97930
    published2017-03-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97930
    titleRHEL 6 : Gluster Storage (RHSA-2017:0494)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0744.NASL
    descriptionAn update for samba4 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id97960
    published2017-03-27
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97960
    titleCentOS 6 : samba4 (CESA-2017:0744)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3158-1.NASL
    descriptionFrederic Besler and others discovered that the ndr_pull_dnsp_nam function in Samba contained an integer overflow. An authenticated attacker could use this to gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-2123) Simo Sorce discovered that that Samba clients always requested a forwardable ticket when using Kerberos authentication. An attacker could use this to impersonate an authenticated user or service. (CVE-2016-2125) Volker Lendecke discovered that Kerberos PAC validation implementation in Samba contained multiple vulnerabilities. An authenticated attacker could use this to cause a denial of service or gain administrative privileges. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-2126). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id95949
    published2016-12-20
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95949
    titleUbuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : samba vulnerabilities (USN-3158-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3272-1.NASL
    descriptionThis update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id96149
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96149
    titleSUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:3272-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-1265.NASL
    descriptionFrom Red Hat Security Advisory 2017:1265 : An update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) * A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619) Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.
    last seen2020-06-01
    modified2020-06-02
    plugin id100344
    published2017-05-23
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100344
    titleOracle Linux 7 : samba (ELSA-2017-1265)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3271-1.NASL
    descriptionThis update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id96148
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96148
    titleSUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:3271-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0662.NASL
    descriptionFrom Red Hat Security Advisory 2017:0662 : An update for samba is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id99069
    published2017-03-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99069
    titleOracle Linux 6 : samba (ELSA-2017-0662)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1265.NASL
    descriptionAn update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) * A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619) Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.
    last seen2020-06-01
    modified2020-06-02
    plugin id100346
    published2017-05-23
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100346
    titleRHEL 7 : samba (RHSA-2017:1265)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1105.NASL
    descriptionAccording to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) - A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619) - A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-06-09
    plugin id100698
    published2017-06-09
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100698
    titleEulerOS 2.0 SP2 : samba (EulerOS-SA-2017-1105)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-364F61377B.NASL
    descriptionSecurity fix for CVE-2016-2125, CVE-2016-2126 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-12-27
    plugin id96108
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96108
    titleFedora 25 : 2:samba (2016-364f61377b)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-776.NASL
    descriptionSimo Sorce of Red Hat discovered that the Samba client code always requests a forwardable ticket when using Kerberos authentication. A target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos
    last seen2020-03-17
    modified2017-01-03
    plugin id96192
    published2017-01-03
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96192
    titleDebian DLA-776-1 : samba security update
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2016-363-02.NASL
    descriptionNew samba packages are available for Slackware 14.2 and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96166
    published2016-12-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96166
    titleSlackware 14.2 / current : samba (SSA:2016-363-02)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170321_SAMBA4_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126)
    last seen2020-03-18
    modified2017-04-06
    plugin id99224
    published2017-04-06
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99224
    titleScientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20170321)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0744.NASL
    descriptionFrom Red Hat Security Advisory 2017:0744 : An update for samba4 is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. Security Fix(es) : * It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) * A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id99072
    published2017-03-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99072
    titleOracle Linux 6 : samba4 (ELSA-2017-0744)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-D0A537062C.NASL
    descriptionUpdate to Samba 4.4.9 ---- Security fix for CVE-2016-2125, CVE-2016-2126 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-01-10
    plugin id96361
    published2017-01-10
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96361
    titleFedora 24 : 2:samba (2017-d0a537062c)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_E4BC323FCC7311E6B704000C292E4FD8.NASL
    descriptionSamba team reports : [CVE-2016-2123] Authenticated users can supply malicious dnsRecord attributes on DNS objects and trigger a controlled memory corruption. [CVE-2016-2125] Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos
    last seen2020-06-01
    modified2020-06-02
    plugin id96164
    published2016-12-28
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96164
    titleFreeBSD : samba -- multiple vulnerabilities (e4bc323f-cc73-11e6-b704-000c292e4fd8)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3299-1.NASL
    descriptionThis update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id96261
    published2017-01-03
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96261
    titleSUSE SLES12 Security Update : samba (SUSE-SU-2016:3299-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-11.NASL
    descriptionThis update for samba fixes the following issues : Security issues fixed : - CVE-2016-2125: Don
    last seen2020-06-05
    modified2017-01-05
    plugin id96293
    published2017-01-05
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96293
    titleopenSUSE Security Update : samba (openSUSE-2017-11)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0100_SAMBA4.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has samba4 packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127327
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127327
    titleNewStart CGSL MAIN 4.05 : samba4 Multiple Vulnerabilities (NS-SA-2019-0100)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-834.NASL
    descriptionA remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root. (CVE-2017-7494) It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126) A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions. (CVE-2017-2619)
    last seen2020-06-01
    modified2020-06-02
    plugin id100554
    published2017-06-01
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/100554
    titleAmazon Linux AMI : samba (ALAS-2017-834) (SambaCry)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170321_SAMBA_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125) - A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126)
    last seen2020-03-18
    modified2017-04-06
    plugin id99225
    published2017-04-06
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99225
    titleScientific Linux Security Update : samba on SL6.x i386/x86_64 (20170321)

Redhat

advisories
  • rhsa
    idRHSA-2017:0494
  • rhsa
    idRHSA-2017:0495
  • rhsa
    idRHSA-2017:0662
  • rhsa
    idRHSA-2017:0744
  • rhsa
    idRHSA-2017:1265
rpms
  • ctdb-0:4.4.6-4.el6rhs
  • ctdb-tests-0:4.4.6-4.el6rhs
  • libsmbclient-0:4.4.6-4.el6rhs
  • libsmbclient-devel-0:4.4.6-4.el6rhs
  • libwbclient-0:4.4.6-4.el6rhs
  • libwbclient-devel-0:4.4.6-4.el6rhs
  • samba-0:4.4.6-4.el6rhs
  • samba-client-0:4.4.6-4.el6rhs
  • samba-client-libs-0:4.4.6-4.el6rhs
  • samba-common-0:4.4.6-4.el6rhs
  • samba-common-libs-0:4.4.6-4.el6rhs
  • samba-common-tools-0:4.4.6-4.el6rhs
  • samba-dc-0:4.4.6-4.el6rhs
  • samba-dc-libs-0:4.4.6-4.el6rhs
  • samba-debuginfo-0:4.4.6-4.el6rhs
  • samba-devel-0:4.4.6-4.el6rhs
  • samba-krb5-printing-0:4.4.6-4.el6rhs
  • samba-libs-0:4.4.6-4.el6rhs
  • samba-pidl-0:4.4.6-4.el6rhs
  • samba-python-0:4.4.6-4.el6rhs
  • samba-test-0:4.4.6-4.el6rhs
  • samba-test-libs-0:4.4.6-4.el6rhs
  • samba-vfs-glusterfs-0:4.4.6-4.el6rhs
  • samba-winbind-0:4.4.6-4.el6rhs
  • samba-winbind-clients-0:4.4.6-4.el6rhs
  • samba-winbind-krb5-locator-0:4.4.6-4.el6rhs
  • samba-winbind-modules-0:4.4.6-4.el6rhs
  • ctdb-0:4.4.6-4.el7rhgs
  • ctdb-tests-0:4.4.6-4.el7rhgs
  • libsmbclient-0:4.4.6-4.el7rhgs
  • libsmbclient-devel-0:4.4.6-4.el7rhgs
  • libwbclient-0:4.4.6-4.el7rhgs
  • libwbclient-devel-0:4.4.6-4.el7rhgs
  • samba-0:4.4.6-4.el7rhgs
  • samba-client-0:4.4.6-4.el7rhgs
  • samba-client-libs-0:4.4.6-4.el7rhgs
  • samba-common-0:4.4.6-4.el7rhgs
  • samba-common-libs-0:4.4.6-4.el7rhgs
  • samba-common-tools-0:4.4.6-4.el7rhgs
  • samba-dc-0:4.4.6-4.el7rhgs
  • samba-dc-libs-0:4.4.6-4.el7rhgs
  • samba-debuginfo-0:4.4.6-4.el7rhgs
  • samba-devel-0:4.4.6-4.el7rhgs
  • samba-krb5-printing-0:4.4.6-4.el7rhgs
  • samba-libs-0:4.4.6-4.el7rhgs
  • samba-pidl-0:4.4.6-4.el7rhgs
  • samba-python-0:4.4.6-4.el7rhgs
  • samba-test-0:4.4.6-4.el7rhgs
  • samba-test-libs-0:4.4.6-4.el7rhgs
  • samba-vfs-glusterfs-0:4.4.6-4.el7rhgs
  • samba-winbind-0:4.4.6-4.el7rhgs
  • samba-winbind-clients-0:4.4.6-4.el7rhgs
  • samba-winbind-krb5-locator-0:4.4.6-4.el7rhgs
  • samba-winbind-modules-0:4.4.6-4.el7rhgs
  • libsmbclient-0:3.6.23-41.el6
  • libsmbclient-devel-0:3.6.23-41.el6
  • samba-0:3.6.23-41.el6
  • samba-client-0:3.6.23-41.el6
  • samba-common-0:3.6.23-41.el6
  • samba-debuginfo-0:3.6.23-41.el6
  • samba-doc-0:3.6.23-41.el6
  • samba-domainjoin-gui-0:3.6.23-41.el6
  • samba-glusterfs-0:3.6.23-41.el6
  • samba-swat-0:3.6.23-41.el6
  • samba-winbind-0:3.6.23-41.el6
  • samba-winbind-clients-0:3.6.23-41.el6
  • samba-winbind-devel-0:3.6.23-41.el6
  • samba-winbind-krb5-locator-0:3.6.23-41.el6
  • samba4-0:4.2.10-9.el6
  • samba4-client-0:4.2.10-9.el6
  • samba4-common-0:4.2.10-9.el6
  • samba4-dc-0:4.2.10-9.el6
  • samba4-dc-libs-0:4.2.10-9.el6
  • samba4-debuginfo-0:4.2.10-9.el6
  • samba4-devel-0:4.2.10-9.el6
  • samba4-libs-0:4.2.10-9.el6
  • samba4-pidl-0:4.2.10-9.el6
  • samba4-python-0:4.2.10-9.el6
  • samba4-test-0:4.2.10-9.el6
  • samba4-winbind-0:4.2.10-9.el6
  • samba4-winbind-clients-0:4.2.10-9.el6
  • samba4-winbind-krb5-locator-0:4.2.10-9.el6
  • ctdb-0:4.4.4-13.el7_3
  • ctdb-tests-0:4.4.4-13.el7_3
  • libsmbclient-0:4.4.4-13.el7_3
  • libsmbclient-devel-0:4.4.4-13.el7_3
  • libwbclient-0:4.4.4-13.el7_3
  • libwbclient-devel-0:4.4.4-13.el7_3
  • samba-0:4.4.4-13.el7_3
  • samba-client-0:4.4.4-13.el7_3
  • samba-client-libs-0:4.4.4-13.el7_3
  • samba-common-0:4.4.4-13.el7_3
  • samba-common-libs-0:4.4.4-13.el7_3
  • samba-common-tools-0:4.4.4-13.el7_3
  • samba-dc-0:4.4.4-13.el7_3
  • samba-dc-libs-0:4.4.4-13.el7_3
  • samba-debuginfo-0:4.4.4-13.el7_3
  • samba-devel-0:4.4.4-13.el7_3
  • samba-krb5-printing-0:4.4.4-13.el7_3
  • samba-libs-0:4.4.4-13.el7_3
  • samba-pidl-0:4.4.4-13.el7_3
  • samba-python-0:4.4.4-13.el7_3
  • samba-test-0:4.4.4-13.el7_3
  • samba-test-libs-0:4.4.4-13.el7_3
  • samba-vfs-glusterfs-0:4.4.4-13.el7_3
  • samba-winbind-0:4.4.4-13.el7_3
  • samba-winbind-clients-0:4.4.4-13.el7_3
  • samba-winbind-krb5-locator-0:4.4.4-13.el7_3
  • samba-winbind-modules-0:4.4.4-13.el7_3